Skip to main content
VluxTech
Blog · Websites & SEO

Is Your Website Safe? 5 Checks You Can Do Today

Most small business owners only think about website security after something goes wrong. The site shows a warning, the domain expires, or an old developer still has the password.

You don't need to be technical to catch most of these problems early. Here are five checks you can do yourself. Each one comes with a test and what to do if it fails.

1. Is the padlock there?

Open your website in Chrome. Next to the address you should see a small icon. If Chrome shows "Not secure", the site doesn't use a private connection, called HTTPS. The site owner has to fix it. (Chrome Help)

Customers see that warning too, especially on a page with a contact form.

Test: type your address starting with http:// instead of https://. A good site switches to https:// on its own.

Fix: ask your hosting company or developer to turn on HTTPS and send all visitors to it. Most hosting companies include this for free.

2. Do you control your domain?

Your domain (yourname.com or yourname.co.id) is your address on the internet. If it expires, or sits in someone else's account, you can lose your website and your email in one go.

Test:

  • Look up your domain on ICANN Lookup. It shows which company your domain is registered with and when it expires. For a .id domain, try IANA's lookup.
  • Then log in to that company's account yourself. Can you? Is the email on the account yours?

Fix: if a designer or ex-employee holds it, ask them to move it to an account in your name. Then switch on auto-renew.

3. Are your logins locked down?

Most break-ins don't need clever hacking. Someone simply uses a stolen or guessed password.

Test:

  • Check your business email on Have I Been Pwned. It shows if that address appeared in a known data leak.
  • List everyone who can log in to your website, hosting and domain. Are there old staff or past developers still on that list?

Fix:

  • Turn on 2-Step Verification for your Google account, so a stolen password alone isn't enough. In your Google Account, go to Security & sign-in, then Turn on 2-Step Verification. (Google's steps)
  • Do the same on your hosting and website admin, if they offer it.
  • Remove people who no longer need access, and change any password you've shared.

4. Has Google spotted a problem?

If your site gets hacked, Google may warn people about it in search results or in the browser. That stops customers before they even reach you.

Test: add your site to Google Search Console. It's free. Then open the Security issues report. It shows Google's findings if your site has been hacked or could harm visitors. (Google's guide)

Fix: if anything is listed, contact your developer or hosting company the same day. Once it's cleaned up, Search Console lets you ask Google to check again.

5. Could you get your site back?

Things break. A plugin update goes wrong, a file gets deleted, or the hosting company has a bad day. What matters is whether you can get your site back.

Test: ask your hosting company or developer three questions:

1. How often is my website backed up?
2. Where are the backups kept? (Not only on the same server.)
3. How long would it take to restore my site from a backup?

Fix: if no one can answer, set up automatic backups now. If your site runs on WordPress, keep WordPress and its plugins up to date as well. Old plugins are a common way in.

What this means for you

  • Put 30 minutes in your calendar this week and go through the five checks.
  • Start with the domain and the logins. They cost the most to lose.
  • Repeat the checks every few months, and every time a staff member or developer leaves.

If you'd like someone to go through these checks with you, book a free consultation. You can also see how we build and look after websites.

Is Your Website Safe? 5 Checks You Can Do Today · VluxTech